Add CA cert support to ws-manager

[csweichel]

When using "self-signed certs" the CA cert with which those certs were signed need to be available in workspaces (no matter if regular, prebuild or image-build).

To this end, ws-manager should gain a config field which carries the name of a secret which ought to be mounted into workspaces. See #9078 for more details as to how this should be mounted.

We should refrain from using the workspace templates for this, because that would mean we'd need to merge templates within the installer. Today, the workspace templates are used solely at the discretion of the installing user.